p PatchFirst

CVE-2014-0138

CVE-2014-0138

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.

EPSS 5.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • curl Debian:12

    Affected ranges
    • ECOSYSTEM: < 7.36.0-1

    Update to 7.36.0-1

  • curl Debian:13

    Affected ranges
    • ECOSYSTEM: < 7.36.0-1

    Update to 7.36.0-1

  • curl Debian:14

    Affected ranges
    • ECOSYSTEM: < 7.36.0-1

    Update to 7.36.0-1

Original sources

Check your server →